Checkpoint HTB Lab

Checkpoint’s HTB LAB

Machine Information

As is common in real life pentests, you will start the Checkpoint box with credentials for the following account alex.turner / Checkpoint2024!

Quick Scan

domain: checkpoint.htb

PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman

First Thought

• Given credential access to win-rm -> No
• SMB Shares -> No value information
• Enum username with ldap. Then try to reuse password ‘Checkpoint2024!’ -> No
• Using Bloodhound to enum -> False because of LDAP Signing Error

BloodyAD

• Then I search for another tool bloodyAD to enum Access Control List(ACL)

alex.turner’s Outbound Object Control

We can see alex.turner has permission to Deleted Object and user Mark Davies. So I try to restore this user.

restore successfully user Mark Davies

Check user mark.davies with give password

valid credential (mark.davies:Checkpoint2024!)

Check SMB Share with mark.davies, We have right to write on DevDrop Share. It suppose to be a RCE here.

DevDrop Share Writable Permission

I use module exploit(multi/fileformat/visual_studio_vsix_exec) in msfconsole to spawn a .vsix file and put it in DevDrop Share.

reverse shell (ryan.brooks)

User Flag : de1d009e44d71a83365ff795402bfdeb

Second Phase: Get root shell

There are 4 suspicious files so I download them to my machine for deeper examine.

sharedStorage

I did check it but nothing in it. Then I upload SharpHound.exe to DC01 host, run it to get the zip file and download to my machine. Upload zip file to BloodHound. Ryan.brooks has GenericWrite to svc_deploy.

svc_deploy

I use SharpSuccessor to create a user in DMSAHolder OU to impersonate svc_deploy.

Get Duong’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Command: .\SharpSuccessor.exe add /impersonate:svc_deploy /path:”ou=DMSAHolder,dc=checkpoint,dc=htb” /account:ryan.brooks /name:pentest_dmsa

ryan.brooks TGT

Then I use ryan.brooks TGT to get pentest_dmsa$ TGS Ticket

Command: .\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/checkpoint.htb /opsec/dmsa /nowrap /ptt /ticket:

pentest_dmsa’s TGS Ticket

Then use this Ticket to ask cifs/checkpoint.htb (SMB service) because our purpose is to access VMBackups Share.

Command: .\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/dc01.checkpoint.htb /dmsa /opsec /nowrap /ptt /ticket:

result

I cant explot it deeper! Will update soon. Seeya!